Records why it must live on its own origin (every navigate.st/bns site
shares one origin and could read its keys), the two sign-in keys, the
AES-SIV port WebCrypto lacks, and the phases.
pithos.sia itself is the website, so people had no obvious address to
type for the app. /app (and /app/<page>) now opens Pithos in Theseus and
through the website's Open my Pithos; it is no longer read as an S3 user
named app.
Builds the AppImage, .deb and tar.gz on tag or by hand, runs the tests and
a headless first-run check (per-user paths, the pinned s3d, the pty), and
keeps the files with their checksums for 14 days.
Pithos runs on the user's computer, so the pithos.sia website could only
describe it. Two ways in now:
- Open in browser (Theseus, desktop) opens the current page in the default
browser with a one-time sign-in link (60 s, single use), unlike the
host's reusable ?t= link.
- The website links to http://127.0.0.1:47621/open?path=/<user>/<drive>.
Any page or local program could follow that link, so the host first
asks the user in its own window (a native dialog on the desktop,
Theseus's approval prompt with the vault unlocked). Only loopback Host
names are accepted, one question at a time, and the website learns
nothing either way.
Sessions started this way are marked external, so the browser does not
get host-only controls such as Back to sidebar.
macOS packages can only be made on macOS. The workflow builds dmg and zip
for Apple Silicon and Intel, ad-hoc signed (Apple Silicon will not start
an unsigned app; there is no Developer ID yet, so Gatekeeper asks once),
then smoke-tests the packaged server, the macOS s3d install and the pty
before uploading the files with their checksums.
Export JSON… gives scripts and agents one file with endpoint, key, secret
and drive. The desktop app now ships for Linux too (AppImage, .deb,
tar.gz), using per-user s3d paths there.
With Linux builds joining Windows in the release list, the check must only
compare builds for its own system, and the link must fetch the Linux
AppImage (or, later, the macOS dmg) rather than the Windows installer.
s3d's Linux defaults (/etc/s3d/s3d.yml, /var/lib/s3d) are for a system
service; a desktop user cannot write them, so the desktop app could
never create its config. When no system config exists and those places
are not writable, Pithos uses ~/.config/s3d/s3d.yml and
~/.local/share/s3d (XDG), and writes the directory into the new config
so s3d itself, started with S3D_CONFIG_FILE, uses the same place.
People setting up backups or AI agents want one small file with the
endpoint, key, secret and drive, in the shape scripts read. Export JSON…
in the key dialog writes exactly that, with a drive picker since a key
reaches all of its user's drives. The secret stays masked in the preview,
and the dialog says the file is unencrypted and suggests one S3 user per
agent. The Theseus save dialog now offers .json for it instead of
.pithoskey.
Sia Storage never tells an app who signed in, so accounts showed up as
"Sia account" until someone found the label field. The approval step,
where people are signing in to Sia Storage anyway, now asks for that
email and saves it as the label; the sidebar card names the account the
moment approval lands.
The desktop app had no way to learn about updates. Its footer now checks
Silent Mode's release list (through the local server, so the console's
CSP stays same-origin) and offers the matching installer or portable
build.
Until now the desktop app only ran from a source checkout, so Pithos was
really usable only inside Theseus. electron-builder (the version Theseus
uses) now makes an NSIS installer and a portable exe; s3d is still fetched
on first run by the checksum-checked installer, so the app stays small and
never ships an s3d it did not verify. Icons are rendered from ui/icon.svg.
Quitting also no longer waits on idle keep-alive sockets before exiting.
Files in your own Sia account can now be shared with anyone through a
navigate.st/sia link that keeps working with this computer off; the
navigate.st service is live, so the buttons can ship.
A share link from s3d only opened where s3d is reachable, which on a
default setup is this computer. Pithos now makes a Sia shared-object URL
for the file the way the Sia SDK does (the indexer's sealed object, its
data key opened with a key derived from s3d's app key) and registers it
at navigate.st, which streams the file from Sia hosts for anyone, with
seeking, even with this computer off. A shared-object URL reads that one
object and nothing else in the account. Files still waiting on this
computer are uploaded first. A folder gets a page with its files and a
player. Settings lists the links, each one can be switched off.
sia-share is the navigate.st side, in Go on the Sia SDK: it keeps short
ids, checks every URL against an allowed indexer, serves files sandboxed
so a shared page cannot run script on navigate.st, and caps sign-ups per
address and downloads per link per day. Host reads are paid by its own
app on Silent Mode's indexer account.
The name and icon at the top looked like a link to the main page but did
nothing. They now open Overview, in the sidebar, the full page and the
web console.
With drives on Silent Mode open at s3.silentmode.st, making a folder
public now shows its navigate.st/s3/<name>/<drive>/<folder>/ address:
a page anyone can open, by the account's BNS name instead of its id.
Public files were addressed by a 32-character account id, and a public
folder answered with JSON, so a link was unusable to send to anyone.
Accounts that signed up with a BNS name can now be addressed by it
(/p/alice.x/<drive>/<folder>/), a public folder opened in a browser is a
page with its files, small pictures and a player (tools still get JSON),
and every link and redirect on it is relative so navigate.st/s3/ serves
the same pages. Pithos shows the navigate.st/s3 address when a folder is
made public.
The Accounts page opens with every Sia account on this computer side by
side, with Switch to and Add another account; Cancel closes dialogs
again and Escape works after a ⋯ menu; the footer's update applies the
new version in place on a Theseus that supports it.
Switching to another account, or adding one, was at the bottom of the
page, under the label editor and a long explanation of which account is
which. The page now opens with the accounts on this computer side by
side: the one in use (with its free space), each set-aside account with
Switch to, and Add another account. The account's details follow.
On a Theseus that can apply an extension in place, the footer's update
downloads the new version and reloads Pithos on it straight away. Older
Theseus versions still offer Restart to apply.
Cancel did nothing in the confirm dialogs (delete, switch account) and
in Add another account: the dialog helper read a Cancel result of false
as "keep the dialog open", a meaning meant only for actions like Copy
link. A fixed result now always closes; only an action that returns
false keeps the dialog. Picking an item from a ⋯ menu also left that
menu's Escape listener behind, so Escape no longer closed any dialog
opened from it.
Accounts first (with the account and its free space), then Overview,
Users & keys and Drives, with Settings and Logs under s3d; Full page as
a one-click icon beside the menu button; a banner for files still
waiting to upload, with leftovers uploaded automatically by default;
s3d no longer races its own commands for the database at start.
s3d keeps small uploads in a local buffer until about 40 MB has built
up, so a handful of files could sit there for months, only on this
computer, while the Overview said 0 B on Sia. Overview and Drives now
say how many files are waiting, that they are only on this computer
until then, and offer Upload now; automatic upload of leftovers (after
10 minutes with no new uploads) is on unless turned off.
After adding another account, opening a page failed with "failed to open
database: table users already exists": a users list ran while s3d was
starting, and both set up the fresh database. A start now waits for
running commands to finish, and commands wait while s3d is starting.
In the sidebar, Full page had moved into the ☰ menu, two clicks away.
It is now also a ⤢ icon in the top bar beside ☰, where an expand button
is usually found (⇤ Back to sidebar in the full-page view on a narrow
screen). The menu keeps the labelled entry.
The menu listed Overview, Drives, Users & keys, Account, Settings, Logs:
the Sia account that everything depends on came fourth, and Drives came
before the users that own them. It now follows the order you set things
up in: Accounts (a card naming the account, with its free space),
Overview, Users & keys, Drives; Settings and Logs, which are about s3d
itself, sit under an "s3d" heading. Same order on desktop and in the
☰ menu; the card updates when the account is renamed or switched.
An .html file in a drive opens as a page in a new tab, sandboxed so its
scripts cannot reach Pithos, with the files beside it loading as on a
website; it can still be read as text. Drives, folders and files can be
renamed, and Drives and Overview show the free space left on the Sia
account. Both work for drives on Silent Mode, where renaming re-encrypts
what it moves.
Renaming refused on hosted drives because encrypted names and contents are
bound to their path. The encrypting client now renames itself: readable
files keep s3d's server-side copy, the rest are decrypted and encrypted again
for their new place. A drive with shared folders or links is not renamed,
since its rules belong to the old name.
Free space is forwarded to the server, whose s3d answers for its own
folder, instead of reporting nothing. space.js now builds on sia-account.js,
so BLAKE2b and the indexer request signing exist once.
S3 has no rename, so files, folders and drives kept the name they were
made with. s3d copies objects in its own database (the copy points at
the same data on Sia), so a rename is a copy to the new name and a
delete of the old: quick, and it uses no extra storage. A drive rename
makes a new bucket, moves every file, rebuilds public access for the new
name (a policy names its bucket) and removes the old one. Names that
already exist are refused. Drives on Silent Mode encrypt with keys tied
to each name, so their client gets no rename until it can re-encrypt.
The drives page and Overview now show how much of the Sia account is
used and how much is free. s3d does not report it; the indexer's
GET /account does, signed with the app key s3d registered (read from its
database for this one request, BLAKE2b-256 + Ed25519 as indexd expects).
An .html file in a drive could only be read as source. It can now also be
opened as a web page in a new tab (Theseus tab, browser tab, or the system
browser from the desktop app), with the CSS, images, scripts and pages
beside it loading as they would from a website.
The page is served under a sandbox CSP without allow-same-origin, so its
scripts run in an opaque origin: they cannot read the Pithos session or
reach its API, only the files of the folder the page link covers. Links
are random, last an hour from last use (12 hours at most), and refuse
paths that leave the folder. Pages decrypt on the fly for drives hosted
on Silent Mode.
Your s3d can now run on Silent Mode's server with your own Sia account, so
apps, S3 clients and share links keep working with the computer off. Names
and contents are encrypted on your computer first; folders you make public,
share by link or open to someone else's key are stored readable, and go back
to encrypted when you stop sharing. Moving there and back carries only s3d's
folder: the recovery phrase stays home and nothing is uploaded to Sia again.
The Account page now shows the account key, storage used and last use as
the indexer reports them, which is how to tell your sia.storage accounts
apart. Leftovers can upload by themselves after a quiet spell.
The new site mode recognises a path by the s3d's user names. With drives on
Silent Mode the local s3d has none, so it now asks the server for them;
otherwise pithos.sia/<user> links stop working once drives move.
Full page opened Pithos at a loopback address such as
127.0.0.1:58678/#/buckets/music-house, which means nothing to anyone
reading it and changes every launch. In Theseus the app now lives at
pithos.sia/<S3 user>/<drive>/<folder>, with pages at pithos.sia/settings,
/account and so on; the root page stays the pithos.sia website.
The add-on answers those paths through Theseus's new site routes. It
passes the session to the control server only for pithos.sia's own
requests and the address bar, never another site's fetch, and only
while the vault is unlocked, as the sidebar panel requires. The server
answers its own files, pages and existing S3 users and reports
anything else as not its own, so the website answers it. The sidebar
and the web console keep #/ addresses; an older Theseus still gets the
loopback address.
Pithos moved to 0.3.9 on master while hosting was built here, so the version
stays master's until the next release is cut. The hosted pieces were carried
into master's new layout: Share for folders lives in the item menu, files the
server can read keep their mark in every view, and other accounts show their
key and cannot be switched back to when they moved to Silent Mode.
A person with several sia.storage accounts (or phrases) could not tell
which one a Pithos s3d used: s3d records only the indexer URL. Pithos now
reads the app key s3d stores after login and asks the indexer, with a
request signed the way indexd's app API expects, for the account's key,
storage used and last use. Those match what sia.storage shows for the app,
and the page explains that the login and the phrase together decide the
account. Earlier accounts set aside on this computer show their key too.
The music player had no volume control; it now has a slider beside a
mute button (a pop-up slider on narrow screens), remembered between
visits.
The share dialog asked for a "public address of s3d" before making a
link, which nobody could fill in usefully. The link is now made as the
dialog opens, with a plain note that it opens only on this computer
while s3d listens on 127.0.0.1; your own public address moved under
"Use my own public address". The Access dialog says the same about
what public means while s3d is local, and that access can be changed
at any time. Dialogs now draw above the player.
A server-sent file list could name paths outside the s3d folder (or the key
file in it), and a failed move back deleted every listed path. Transfers now
accept only s3d data paths, check all of them before writing, never
overwrite, and clean up only what they wrote.
A lost reply could lose or fork the drives: move-up and move-down now ask the
server who holds them before touching the local copy, and once the server is
told to release, the local copy is never removed (the release is retried).
The gateway no longer lets one account route another's access key id, refuses
. and .. in shared-key paths, strips presign parameters before re-signing,
counts upload size on disk, stops s3d before it can be restarted mid-move, and
claims sign-up proofs before checking them. The key file is never replaced
when unreadable, a local edit removes the older encrypted copy, listing pages
no longer repeat, and data hashes stream instead of loading whole files.
In the sidebar the menu now drops down from a ☰ in the top-right
corner, opposite the Pithos name, and holds every page plus Open as
full page, instead of pushing the page down.
Get started and Sia connection become one Account page: the guide
until an account is connected, then the account with its label, Add
another account (the guide, titled Add a Sia account) and the other
accounts on this computer, each one click to switch back to.
On narrow screens file rows show Download and Share as icons, hide
the size, and wrap names to two lines at most.
Pithos only updated when Theseus happened to check the extension
channel on a restart, and nothing showed which version was running.
A footer now shows pithos.sia and the version, as Aegis's does. In
Theseus it checks the channel when Pithos opens and every six hours;
a newer release shows as "↑ vX", one click downloads and verifies it,
and a second asks Theseus to restart and apply it. ↻ checks on demand.
Opening an MP3 used to show it in a dialog, so the music stopped as soon
as you went on looking through your drive. Audio now plays in a player
docked at the bottom of Pithos that stays through folder, drive and page
changes and plays on through the folder it started from, with previous,
next, seek and the keyboard's media keys. An expired view link is
renewed mid-track instead of stopping playback.
Drives and folders can be shown as icons (pictures preview themselves),
a compact list, or a details table with type and date, remembered per
page. Per-item actions move into a ⋯ menu so rows fit a narrow panel.
In the 400 px Theseus sidebar the navigation folds into a compact bar
with the page name, the s3d status and a menu button, so the page gets
the room. The Widen button is gone: widening squeezed the open tab and
the right sidebar. Full page opens Pithos as an ordinary tab instead.
Records what was built against the plan (names are encrypted from v1, rights
for other people are folder-scoped S3 keys), how to run pithos-hosted, and
that paid storage belongs to Hestia, a separate product.
Settings gains a sign-in, sign-up and move card for Silent Mode; Overview,
the status pill, Access and Share follow the server when drives are hosted.
Folders get their own Share (public, or a key with read/add/edit rights),
since per-folder access is what hosting adds over a bare s3d. Files the
server can still read are marked, and Access can encrypt the ones that
predate the move.
The gateway is the only thing standing between a shared key and the rest of
an owner's drive, so its SigV4 check, grant decisions and the BNS/deposit
proofs get tests that need no s3d to run.
s3d binds one Sia account per process, so the server runs one s3d per
person (pithos-hosted), started on demand and flushed and stopped when idle.
Only the connected s3d data folder moves between PC and server; the Sia
recovery phrase never leaves the PC and nothing is re-uploaded to Sia.
Because the server holds the connection key, local Pithos encrypts names and
contents before they leave the machine, with keys from the Theseus vault (or
a local key file elsewhere). What s3d cannot do on its own, the gateway now
enforces: public folders, expiring share links and S3 keys for other people
limited to one folder with read, add-only or edit rights. Files those reach
are stored readable, since visitors have no key, and go back to encrypted
when the rule is removed. Sign-up needs a BNS name signature, a deposit or
an invite, with a per-IP limit.
Hosted drives sit on a server that holds the Sia connection key, so private
files must be unreadable there. Names are encrypted per path segment with
AES-SIV (deterministic, so folders and prefix listing still work on the
server) and bodies with chunked AES-256-GCM bound to drive and path, with
sizes computable both ways so uploads stream and range reads stay cheap.
s3d only sends full ~40 MB blocks to Sia, so a handful of small files can
stay in the local buffer forever (seen: 63 objects, 6 MiB, nothing on Sia).
An opt-in setting now flushes once the pending set has not changed for N
minutes, judged from s3d's upload stats so uploads from any S3 client count.
Failed flushes back off up to an hour instead of hammering a broken indexer.
One s3d serves one Sia account, so hosting means one s3d per user on the
server. Writing down the agreed model (bring your own sia.storage account,
client-side encryption except public files, BNS-name-or-deposit gate), how
the gateway enforces per-folder rights s3d cannot, and how a data folder
moves between PC and server without re-uploading to Sia, before building.
